JE
DevOps
Jenkins
On CISA KEVExploited in the wildRansomware-linked
301
CVEs
6
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 22High 62Medium 146Low 5
Watch
Add Jenkins to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-43045 | 6.3 | Aug 7 | Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users'… Affected: before 2.452.4; before 2.471 |
| CVE-2021-21610 | 6.1 | Jan 13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering a formatted preview of markup passed as a query parameter, resulting… Affected: through 2.263.1; through 2.274 |
| CVE-2012-4441 | 6.1 | Nov 18 | Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin Affected: before 1.466.2; before 1.482 |
| CVE-2012-4440 | 6.1 | Nov 18 | Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the Violations plugin Affected: before 1.466.2; before 1.482 |
| CVE-2012-4439 | 6.1 | Nov 18 | Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to… Affected: before 1.466.2; before 1.482 |
| CVE-2018-1000407 | 6.1 | Jan 9 | A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs… Affected: through 2.138.1; through 2.145 |
| CVE-2016-0789 | 6.1 | Apr 7 | CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct… Affected: through 1.642.1; through 1.649 |
| CVE-2017-1000396 | 5.9 | Jan 26 | Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates,… Affected: through 2.73.1; through 2.83 |
| CVE-2020-2100 | 5.8 | Jan 29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848 Affected: through 2.204.1; through 2.218 |
| CVE-2026-84654 | 5.4 | Sep 2 | In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding allows setting… Affected: All versions, or not specified |
| CVE-2026-53441 | 5.4 | Jun 10 | Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be… Affected: 2.483 before 2.568; 2.492.1 before 2.555.3 |
| CVE-2025-27624 | 5.4 | Mar 5 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/expanded status of… Affected: before 2.492.2; before 2.500 |
| CVE-2023-43495 | 5.4 | Sep 20 | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site… Affected: before 2.414.2; before 2.424 |
| CVE-2023-39151 | 5.4 | Jul 26 | Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site… Affected: through 2.415; through 2.401.2 |
| CVE-2022-41224 | 5.4 | Sep 21 | Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored… Affected: 2.367 before 2.370 |
| CVE-2022-34173 | 5.4 | Jun 23 | In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site… Affected: 2.340 through 2.355 |
| CVE-2022-34172 | 5.4 | Jun 23 | In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS)… Affected: 2.340 through 2.355 |
| CVE-2022-34171 | 5.4 | Jun 23 | In Jenkins 2.321 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the HTML output generated for new symbol-based SVG icons includes the 'title'… Affected: 2.321 through 2.355; 2.332.1 through 2.332.3 |
| CVE-2022-34170 | 5.4 | Jun 23 | In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip,… Affected: 2.320 through 2.355; 2.332.1 through 2.332.3 |
| CVE-2021-21611 | 5.4 | Jan 13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page, resulting in a stored cross-site scripting (XSS)… Affected: through 2.263.1; through 2.274 |
| CVE-2021-21608 | 5.4 | Jan 13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by… Affected: through 2.263.1; through 2.274 |
| CVE-2021-21603 | 5.4 | Jan 13 | Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability Affected: through 2.263.1; through 2.274 |
| CVE-2020-2231 | 5.4 | Aug 12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site… Affected: through 2.235.3; through 2.251 |
| CVE-2020-2230 | 5.4 | Aug 12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability… Affected: through 2.235.3; through 2.251 |
| CVE-2020-2229 | 5.4 | Aug 12 | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability Affected: through 2.235.3; through 2.251 |
| CVE-2020-2223 | 5.4 | Jul 15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a… Affected: through 2.235.1; through 2.244 |
| CVE-2020-2222 | 5.4 | Jul 15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip, resulting in a stored cross-site scripting… Affected: through 2.235.1; through 2.244 |
| CVE-2020-2221 | 5.4 | Jul 15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting… Affected: through 2.235.1; through 2.244 |
| CVE-2020-2220 | 5.4 | Jul 15 | Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability Affected: through 2.235.1; through 2.244 |
| CVE-2020-2163 | 5.4 | Mar 25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able… Affected: through 2.204.5; through 2.227 |
| CVE-2020-2162 | 5.4 | Mar 25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not set Content-Security-Policy headers for files uploaded as file parameters to a build, resulting in a stored XSS… Affected: through 2.204.5; through 2.227 |
| CVE-2020-2161 | 5.4 | Mar 25 | Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages,… Affected: through 2.204.5; through 2.227 |
| CVE-2020-2105 | 5.4 | Jan 29 | REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks Affected: through 2.204.1; through 2.218 |
| CVE-2020-2103 | 5.4 | Jan 29 | Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page Affected: through 2.204.1; through 2.218 |
| CVE-2019-10405 | 5.4 | Sep 25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS… Affected: through 2.176.3; through 2.196 |
| CVE-2019-10404 | 5.4 | Sep 25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users… Affected: through 2.176.3; through 2.196 |
| CVE-2019-10403 | 5.4 | Sep 25 | Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users… Affected: through 2.176.3; through 2.196 |
| CVE-2019-10402 | 5.4 | Sep 25 | In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by… Affected: through 2.176.3; through 2.196 |
| CVE-2019-10401 | 5.4 | Sep 25 | In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability… Affected: through 2.176.3; through 2.196 |
| CVE-2019-1003050 | 5.4 | Apr 10 | The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site… Affected: through 2.164.1; through 2.171 |
| CVE-2018-1000409 | 5.4 | Jan 9 | A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that prevented… Affected: through 2.138.1; through 2.145 |
| CVE-2018-1999045 | 5.4 | Aug 23 | A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers… Affected: through 2.121.2; through 2.137 |
| CVE-2018-1999007 | 5.4 | Jul 23 | A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers… Affected: through 2.121.1; 2.122 through 2.132 |
| CVE-2018-1999005 | 5.4 | Jul 23 | A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers… Affected: through 2.121.1; 2.122 through 2.132 |
| CVE-2017-2607 | 5.4 | May 21 | jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382) Affected: before 2.44; before 2.32.2 |
| CVE-2017-2613 | 5.4 | May 15 | jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins Affected: before 2.32.2; before 2.44 |
| CVE-2017-2610 | 5.4 | May 15 | jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than… Affected: before 2.32.2; before 2.44 |
| CVE-2017-2612 | 5.4 | May 15 | In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly failing to download… Affected: before 2.44; before 2.32.2 |
| CVE-2017-2601 | 5.4 | May 10 | Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353) Affected: before 2.32.2; before 2.44 |
| CVE-2018-1000170 | 5.4 | Apr 16 | A cross-site scripting vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in confirmationList.jelly and stopButton.jelly that allows attackers with… Affected: through 2.105; through 2.107.1 |